hi pjanzen,
This is my conf file
input {
file{
path => "E:\softwares\logstash-6.5.4\bin\PA_FW_Traffic-2018-09-10.txt"
start_position => beginning
}
}
filter{
mutate {
remove_field => ["facility_label","facility","@version","priority","tags","host","timestamp","severity_label","severity","logsource"]
split => { "message" => "," }
}
grok {
match => { "message" => ["^{timestamp}"] }
}
date {
match => [ "timestamp", "yyyy-MM-dd :HH:mm:ss ZZZ" ]
target => "@timestamp"
}
}
output {
stdout {}
file {
path => "E:/testmessage.txt"
codec => line { format => ["%{@timestamp},%{message}"] }
}
}